[Vwdiesel] Virus, Anti

[Bill Truesdell]

Lee,
it is not from the list but from-
                Lucre, Inc. (NETBLK-LUCRE)
                   4011 Plainfield Ave
                   Grand Rapids, MI 49525
                   US

                   Netname: LUCRE
                   Netblock: 216.65.160.0 - 216.65.191.255
                   Maintainer: LUCR

                   Coordinator:
                      Hale, Steve  (SH1448-ARIN)  steve at lucre.net
                      (616) 361-0128

The actual sender is the last "recieved from". So "Received: from
unknown (HELO Jijkxlwla) (216.65.164.230)" shows a fake email address-
note no @ but must have a true ISP - 216.65.164.230 - which can be
looked up on whois (I use geektools)
http://www.geektools.com/cgi-bin/proxy.cgi
to get the sending ISP. Then they can be contacted to correct the
problem.

The sender of the Klez virus is seldom the one listed in the from
header, but is always the ISP of the last "recieved from".

Bill Truesdell
Bath, ME


Lee Hillsgrove wrote:
>
> >
> >Found virus WORM_KLEZ.H in file src.scr
> >The file is deleted.
> >
>
>   Now that's ironic, a virus supposedly coming from the list owner! Klez
> strikes again!
>  I actually got the Klez virus mailed to me apparently from myself.
> Obviously it was from someone else who had my name in their address book.
>
>  Here are the message headers from the original message I received. The
> actual virus was stripped off, so my antivirus program never saw it.
>  If I read this correctly, it actually came from this address:
> vwdiesel-admin at vwfans.com
>  I have found that the return-path address is the true address it was sent
> from. So, perhaps Dan's machine IS infected? Hopefully someone who knows
> more about this can comment and perhaps set me straight if I'm wrong.
>
>   Lee
>   Oo-v-oO
>   PP-ASEL
>   KB1GNI
>
>  Return-Path: <vwdiesel-admin at vwfans.com>
> Received: from smtprelay10.dc2.adelphia.net ([64.8.50.54]) by
>           ms002a.dc2.adelphia.net (Netscape Messaging Server 4.15 ms002
>           Mar  5 2002 15:11:07) with ESMTP id GYPASA00.I2T for
>           <hillsgrove at abs.adelphia.net>; Wed, 3 Jul 2002 21:28:58 -0400
> Received: from cps2.cps.adelphia.net ([24.48.57.12]) by
>           smtprelay10.dc2.adelphia.net (Netscape Messaging Server 4.15)
>           with ESMTP id GYPAS901.1AW; Wed, 3 Jul 2002 21:28:57 -0400
> Received: from www.audifans.com (64-205-178-107.client.dsl.net
> [64.205.178.107])
>  by cps2.cps.adelphia.net (8.12.3/8.12.3) with ESMTP id g641RfbN028071;
>  Wed, 3 Jul 2002 21:28:56 -0400 (EDT)
> Received: by www.audifans.com (Postfix, from userid 0)
>  id 3547A4E2; Wed,  3 Jul 2002 21:30:25 -0400 (EDT)
> Received: from www.audifans.com (localhost [127.0.0.1])
>  by www.audifans.com (Postfix) with ESMTP
>  id 2F316301; Wed,  3 Jul 2002 21:30:16 -0400 (EDT)
> Delivered-To: vwdiesel at www.audifans.com
> Received: by www.audifans.com (Postfix, from userid 0)
>  id 20C92310; Wed,  3 Jul 2002 21:25:46 -0400 (EDT)
> Received: from mail.triton.net (localhost [127.0.0.1])
>  by www.audifans.com (Postfix) with SMTP id 8652F301
>  for <vwdiesel at vwfans.com>; Wed,  3 Jul 2002 21:25:44 -0400 (EDT)
> Received: (qmail 15467 invoked from network); 4 Jul 2002 01:29:05 -0000
> Received: from unknown (HELO Jijkxlwla) (216.65.164.230)
>   by mail.triton.net with SMTP; 4 Jul 2002 01:29:05 -0000
> From: dans <dans at audifans.com>
> To: vwdiesel at vwfans.com
> MIME-Version: 1.0
> Message-Id: <20020704012546.20C92310 at www.audifans.com>
> content-transfer-encoding: 7bit
> content-type: text/plain
> x-plaintext: Picked text/plain from multipart/alternative
> Subject: [Vwdiesel] Virus, Anti
> Sender: vwdiesel-admin at vwfans.com
> Errors-To: vwdiesel-admin at vwfans.com
> X-BeenThere: vwdiesel at vwfans.com
> X-Mailman-Version: 2.0.8
> Precedence: bulk
> List-Unsubscribe: <http://www.audifans.com/mailman/listinfo/vwdiesel>,
>  <mailto:vwdiesel-request at vwfans.com?subject=unsubscribe>
> List-Id: Discussion of  <vwdiesel.vwfans.com>
> List-Post: <mailto:vwdiesel at vwfans.com>
> List-Help: <mailto:vwdiesel-request at vwfans.com?subject=help>
> List-Subscribe: <http://www.audifans.com/mailman/listinfo/vwdiesel>,
>  <mailto:vwdiesel-request at vwfans.com?subject=subscribe>
> List-Archive: <http://www.audifans.com/pipermail/vwdiesel/>
> Date: Wed,  3 Jul 2002 21:25:46 -0400 (EDT)